linux-stable.git/arch/alpha, branch linux-2.6.35.y Linux kernel stable tree alpha: fix several security issues 2011-08-01T20:54:59+00:00 Dan Rosenberg drosenberg@vsecurity.com 2011-06-15T22:09:01+00:00 5c118168c852e64bc273ad62b63b773cd58a4efc [ upstream commit 21c5977a836e399fc710ff2c5367845ed5c2527f ] Fix several security issues in Alpha-specific syscalls. Untested, but mostly trivial. 1. Signedness issue in osf_getdomainname allows copying out-of-bounds kernel memory to userland. 2. Signedness issue in osf_sysinfo allows copying large amounts of kernel memory to userland. 3. Typo (?) in osf_getsysinfo bounds minimum instead of maximum copy size, allowing copying large amounts of kernel memory to userland. 4. Usage of user pointer in osf_wait4 while under KERNEL_DS allows privilege escalation via writing return value of sys_wait4 to kernel memory. Said to fix CVE-2011-2208 to CVE-2011-2211 Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: Matt Turner <mattst88@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Andi Kleen <ak@linux.intel.com> 
[ upstream commit 21c5977a836e399fc710ff2c5367845ed5c2527f ]

Fix several security issues in Alpha-specific syscalls.  Untested, but
mostly trivial.

1. Signedness issue in osf_getdomainname allows copying out-of-bounds
kernel memory to userland.

2. Signedness issue in osf_sysinfo allows copying large amounts of
kernel memory to userland.

3. Typo (?) in osf_getsysinfo bounds minimum instead of maximum copy
size, allowing copying large amounts of kernel memory to userland.

4. Usage of user pointer in osf_wait4 while under KERNEL_DS allows
privilege escalation via writing return value of sys_wait4 to kernel
memory.

Said to fix CVE-2011-2208 to CVE-2011-2211

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
alpha: Fix printk format errors 2010-09-27T00:18:43+00:00 Michael Cree mcree@orcon.net.nz 2010-09-01T15:25:17+00:00 97fe34b1a65bcdf9eb994423e95d7edb1ec491c5 commit 3e073367a57d41e506f20aebb98e308387ce3090 upstream. When compiling alpha generic build get errors such as: arch/alpha/kernel/err_marvel.c: In function ‘marvel_print_err_cyc’: arch/alpha/kernel/err_marvel.c:119: error: format ‘%ld’ expects type ‘long int’, but argument 6 has type ‘u64’ Replaced a number of %ld format specifiers with %lld since u64 is unsigned long long. Signed-off-by: Michael Cree <mcree@orcon.net.nz> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 3e073367a57d41e506f20aebb98e308387ce3090 upstream.

When compiling alpha generic build get errors such as:
arch/alpha/kernel/err_marvel.c: In function ‘marvel_print_err_cyc’:
arch/alpha/kernel/err_marvel.c:119: error: format ‘%ld’ expects type ‘long int’, but argument 6 has type ‘u64’

Replaced a number of %ld format specifiers with %lld since u64
is unsigned long long.

Signed-off-by: Michael Cree <mcree@orcon.net.nz>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix call to replaced SuperIO functions 2010-09-27T00:18:39+00:00 Morten H. Larsen m-larsen@post6.tele.dk 2010-09-01T02:29:13+00:00 92e8e73dcc82076d63296c03700a3d6324672028 commit 59b25ed91400ace98d6cf0d59b1cb6928ad5cd37 upstream. This patch fixes the failure to compile Alpha Generic because of previously overlooked calls to ns87312_enable_ide(). The function has been replaced by newer SuperIO code. Tested-by: Michael Cree <mcree@orcon.net.nz> Signed-off-by: Morten H. Larsen <m-larsen@post6.tele.dk> Signed-off-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> 
commit 59b25ed91400ace98d6cf0d59b1cb6928ad5cd37 upstream.

This patch fixes the failure to compile Alpha Generic because of
previously overlooked calls to ns87312_enable_ide(). The function has
been replaced by newer SuperIO code.

Tested-by: Michael Cree <mcree@orcon.net.nz>
Signed-off-by: Morten H. Larsen <m-larsen@post6.tele.dk>
Signed-off-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
alpha: Detect Super IO chip, no IDE on Avanti, enable EPP19 2010-06-15T18:19:08+00:00 Morten H. Larsen m-larsen@post6.tele.dk 2010-06-15T17:22:11+00:00 932e0c201d28a728e25d3b641aa95bd28ceb08b4 This patch probes for the Super IO chip and reserves the IO range when found. It avoids enabling the IDE interface on the Avanti family, since none has IDE. It enables the Enhanced Parallel Port v1.9 feature. Signed-off-by: Morten H. Larsen <m-larsen@post6.tele.dk> Signed-off-by: Matt Turner <mattst88@gmail.com> 
This patch probes for the Super IO chip and reserves the IO range when
found. It avoids enabling the IDE interface on the Avanti family, since
none has IDE. It enables the Enhanced Parallel Port v1.9 feature.

Signed-off-by: Morten H. Larsen <m-larsen@post6.tele.dk>
Signed-off-by: Matt Turner <mattst88@gmail.com>
alpha: fix pci_mmap_resource API breakage 2010-06-15T18:19:07+00:00 Matt Turner mattst88@gmail.com 2010-06-15T17:19:36+00:00 5efa16ff77cb785647a480dcdc70a6b4fc787996 Caused by 2c3c8bea608866d8bd9dcf92657d57fdcac011c5 which was clearly not even compile tested. Signed-off-by: Matt Turner <mattst88@gmail.com> 
Caused by 2c3c8bea608866d8bd9dcf92657d57fdcac011c5 which was clearly not
even compile tested.

Signed-off-by: Matt Turner <mattst88@gmail.com>
alpha: fix __arch_hweight32 typo 2010-06-15T18:19:07+00:00 Matt Turner mattst88@gmail.com 2010-06-07T00:06:40+00:00 87a9d57da41e70dc85adf23e158308527c051b3a Typo in 1527bc8b928dd1399c3d3467dd47d9ede210978a renamed hweight32 to __arch_weight32. Signed-off-by: Matt Turner <mattst88@gmail.com> 
Typo in 1527bc8b928dd1399c3d3467dd47d9ede210978a renamed hweight32 to
__arch_weight32.

Signed-off-by: Matt Turner <mattst88@gmail.com>
asm-generic: remove ARCH_HAS_SG_CHAIN in scatterlist.h 2010-05-27T16:12:54+00:00 FUJITA Tomonori fujita.tomonori@lab.ntt.co.jp 2010-05-26T21:44:34+00:00 1ef04370d823a811d2cca9f237097559a6b99b12 There are more architectures that don't support ARCH_HAS_SG_CHAIN than those that support it. This removes removes ARCH_HAS_SG_CHAIN in asm-generic/scatterlist.h and lets arhictectures to define it. It's clearer than defining ARCH_HAS_SG_CHAIN asm-generic/scatterlist.h and undefing it in arhictectures that don't support it. Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
There are more architectures that don't support ARCH_HAS_SG_CHAIN than
those that support it.  This removes removes ARCH_HAS_SG_CHAIN in
asm-generic/scatterlist.h and lets arhictectures to define it.

It's clearer than defining ARCH_HAS_SG_CHAIN asm-generic/scatterlist.h and
undefing it in arhictectures that don't support it.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
alpha: use asm-generic/scatterlist.h 2010-05-27T16:12:54+00:00 FUJITA Tomonori fujita.tomonori@lab.ntt.co.jp 2010-05-26T21:44:34+00:00 48c7cf4797d04b3ffcb060fa64c3c500b7371e8b Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp> Acked-by: Matt Turner <mattst88@gmail.com> Cc: Richard Henderson <rth@twiddle.net> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Acked-by: Matt Turner <mattst88@gmail.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Revert "endian: #define __BYTE_ORDER" 2010-05-26T15:30:15+00:00 Linus Torvalds torvalds@linux-foundation.org 2010-05-26T15:30:15+00:00 13da9e200fe4740b02cd51e07ab454627e228920 This reverts commit b3b77c8caef1750ebeea1054e39e358550ea9f55, which was also totally broken (see commit 0d2daf5cc858 that reverted the crc32 version of it). As reported by Stephen Rothwell, it causes problems on big-endian machines: > In file included from fs/jfs/jfs_types.h:33, > from fs/jfs/jfs_incore.h:26, > from fs/jfs/file.c:22: > fs/jfs/endian24.h:36:101: warning: "__LITTLE_ENDIAN" is not defined The kernel has never had that crazy "__BYTE_ORDER == __LITTLE_ENDIAN" model. It's not how we do things, and it isn't how we _should_ do things. So don't go there. Requested-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 
This reverts commit b3b77c8caef1750ebeea1054e39e358550ea9f55, which was
also totally broken (see commit 0d2daf5cc858 that reverted the crc32
version of it).  As reported by Stephen Rothwell, it causes problems on
big-endian machines:

> In file included from fs/jfs/jfs_types.h:33,
>                  from fs/jfs/jfs_incore.h:26,
>                  from fs/jfs/file.c:22:
> fs/jfs/endian24.h:36:101: warning: "__LITTLE_ENDIAN" is not defined

The kernel has never had that crazy "__BYTE_ORDER == __LITTLE_ENDIAN"
model.  It's not how we do things, and it isn't how we _should_ do
things.  So don't go there.

Requested-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
alpha: simplify and optimize sched_find_first_bit 2010-05-25T22:40:28+00:00 Matt Turner mattst88@gmail.com 2010-04-29T02:49:36+00:00 a75f5f0f0a3676216e0015b3040c785dbfe1e0da Search only the first 100 bits instead of 140, saving a couple instructions. The resulting code is about 1/3 faster (40K ticks/1000 iterations down to 30K ticks/1000 iterations). Cc: Peter Zijlstra <peterz@infradead.org> Cc: Ingo Molnar <mingo@elte.hu> Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru> Cc: linux-alpha@vger.kernel.org Acked-by: Richard Henderson <rth@twiddle.net> Signed-off-by: Matt Turner <mattst88@gmail.com> 
Search only the first 100 bits instead of 140, saving a couple
instructions. The resulting code is about 1/3 faster (40K ticks/1000
iterations down to 30K ticks/1000 iterations).

Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: linux-alpha@vger.kernel.org
Acked-by: Richard Henderson <rth@twiddle.net>
Signed-off-by: Matt Turner <mattst88@gmail.com>